SECURITY OPS // SOVEREIGN SOFTWARE LAB
I build software that can be inspected, reproduced, self-hosted and owned.
privacy engineering · systems · GNU Guix · post-quantum experiments · free software
Most software asks you to trust it. I prefer systems that give you evidence.
I am an IT Support Analyst from Brazil and an independent open-source builder. Outside work, I design privacy-conscious tools, experiment with secure systems, maintain self-hosted infrastructure and contribute fixes upstream.
▸ boot.log — open operator profile
operator Cristian Cezar Moises
base Brazil
mission user-controlled, auditable software
runtime GNU/Linux · GNU Guix · self-hosted infrastructure
signal privacy · reproducibility · security · open development
status building in public
Security claims should be testable. Infrastructure should be reproducible. Users should remain in control.
NODE 01 // PUBLIC INTERFACES
Live tools you can open now. Each node links back to its source.
| Node | What it does | Source | Pulse |
|---|---|---|---|
| ZUPT | Encrypted backup and compression with post-quantum key encapsulation | source |
 |
| Zupt Web | Post-quantum backup directly in the browser | source |
 |
| Mirim | Tiny embedded SQL database, encrypted at rest by default | source |
 |
| SecurityOS | Browser-based security, privacy and education environment | source |
 |
| MusicMagic | Local-first music creation studio | source |
 |
| Dopamine | Prediction-market simulator for learning — no real money | source |
 |
| TurboRec | High-quality recording workflow powered by FFmpeg | source |
 |
| WhatsAppel | Emacs client with a Node/Baileys bridge | source |
 |
Status badges are live checks, not uptime guarantees.
NODE 02 // ORIGINAL SOURCE
A focused selection of original public work. Forks are intentionally excluded.
| System | Core idea | Built with |
|---|---|---|
| ZUPT | Authenticated encrypted backups with compression and post-quantum key encapsulation | C |
| VaptVupt Codec | Lossless LZ + tANS compression codec | C |
| libvuptsdk | Hybrid ML-KEM-768 + X25519 cryptography SDK | C |
| Mirim | Small embedded SQL with encrypted storage and sealed exports | Rust |
| Evelin | Post-quantum secure transport protocol (GitHub mirror) | Rust |
| Cofre Soberano PQ | Post-quantum signed audit logs and authenticated gateway | Rust |
| Esquema | Rootless Linux containers described as Scheme values | Guile + C |
| SecurityOps OS | Hardened GNU Guix system work | Shell |
| GuixVis | Interactive GNU Guix package and dependency explorer | Rust |
| Guix Vault | Guix-native reproducible backup and disaster recovery | Scheme |
| Xmonad-Wayland | XMonad window-management policy for the River compositor | Python |
| Torando | Per-user Tor routing with a transparent proxy and killswitch | Python |
| Keywave | Ephemeral chat and video communication without server-side storage | Python |
▸ inspect another layer — infrastructure and experiments
| Repository | Signal |
|---|---|
| securityops-channel | Custom GNU Guix channel |
| hnews | Fast, script-free Hacker News reader |
NODE 03 // MERGED CONTRIBUTIONS
These are external repositories I contributed to — listed separately from my own projects and backed by merged pull requests.
cabelo/libzupt — cryptographic hardening, key handling and release engineering
SciPhi-AI/R2R — service and CLI robustness
zen-browser/desktop — build configuration and scripts
Ahwxorg/Binternet — safer output handling
emmabostian/developer-portfolios — community directory
NODE 04 // STACK AND PRINCIPLES
▸ toolchain
Systems: GNU/Linux · GNU Guix · Gentoo · FreeBSD
Languages: C · Rust · Scheme/Guile · Python · Shell · JavaScript
Operations: self-hosting · Forgejo · Docker · Tor · FFmpeg
Current orbit: reproducible systems, encrypted storage, compression, post-quantum migration and user-controlled infrastructure.
▸ operating principles
- Prefer evidence over security theatre.
- Make the source inspectable and the limits explicit.
- Keep infrastructure reproducible whenever practical.
- Design for user autonomy, not user lock-in.
- Learn in public and send useful fixes upstream.
▸ verified credentials — open gallery
